Hi,
I am working on a query where i need to display the table based on the multiselect input.
multi-select input options are : (nf, sf, etc)
When i select "nf " then only columns starts with "nf" should display along with "user" and "role" and also display the columns in same order as it is mentioned,
similarly to be applied if i am selecting multiple options from the multi-select input as well
but,
iam facing a issue while fetching the table in same order.
i have tried using
|<search query>
| stats list(*) as * by user, role
but this one jumbles the column placement in alphabetical order, which i don't want to.
also,
tried using set tokens by giving the field_name starts with "nf" in one token and sf in another token.
|< search query>
| table user, role, $nf_fields$ $,sf_fields$
by trying this method also faced an issue
example: if i am selecting only sf from the multi select input
then the fields starts with nf also displayed with empty values
--> Is it possible to fix the placement of the columns.
or,
--> removing the empty columns based on the multi-select input
both approaches works for me.
Expected Output:
please help me to solve this.
Thanks in advance.
Hi,
If un-necessary fields displaying from token, then please check whether you've unset token 'nf' when 'sf' is present and vice versa if 'nf' present then unset 'sf' fields.
Hi @KR1,
sorry but I don't understand your issue:
is your issue on the columns or on the displayed values (as I can understand from your screenshots)?
if on the columns, is your issue that you want the columns in a specified order (which order?), or you don't want to display empty columns?
Ciao.
Giuseppe